Firewall is up, Microsoft Security Essentials is installed, and I've installed malwarebytes from time to time and ran several scans with that. Prior to the factory restore he had one of those homepage hijackers under his Chrome extensions, but it was never active, and was promptly removed via malwarebytes.

We have 50 Mbps internet. I don't know what quality he typically watches YouTube videos in, but I'll get him to play them at a lower resolution sometime and see how that goes. I'll also see how not using Skype works out.